pal-e-docs

Review: CI clone broken — Forgejo internal URL unreachable (v2)

review-221-2026-03-21-v2 Review

review ready
Project

Verdict: READY

Re-review after root cause correction in issue comment #2. The original review (review-221-2026-03-21) correctly flagged the wrong hypothesis (namespace mismatch). The updated diagnosis — Forgejo binding to IPv6 only ([::]:80) with no IPv4 LISTEN sockets — is credible, specific, and actionable. The fix is a one-line Helm values change.

Template Completeness

  • [x] Lineage — plan-pal-e-platform → Platform Hardening, standalone discovered
  • [x] Repo — forgejo_admin/pal-e-platform
  • [x] What Broke (substitutes User Story for bug type) — clear reproduction, error message included
  • [x] Context — root cause now documented in comment #2 (IPv6-only binding)
  • [x] File Targets — added in comment #2: terraform/main.tf Forgejo Helm values, server config block
  • [x] Acceptance Criteria — 3 items, all verifiable
  • [ ] Test Expectations — no explicit test commands, but acceptable: verification is "push a commit, watch pipeline succeed"
  • [ ] Constraints — not stated, but implicit: must not revert to Tailscale funnel URL (issue #107 regression)
  • [ ] Checklist — missing but non-blocking for agent execution
  • [x] Related — links to #107, PR #118, PR #117

File Targets

  • [x] terraform/main.tf lines 626-630 — verified: Forgejo Helm release gitea.config.server block exists with DOMAIN, ROOT_URL, SSH_DOMAIN. No HTTP_ADDR setting present. Adding HTTP_ADDR = "0.0.0.0" here is the correct location.
  • [x] terraform/main.tf line 614 — verified: chart is oci://code.forgejo.org/forgejo-helm/forgejo version 16.2.0. The gitea.config.server path maps to Forgejo's app.ini [server] section.
  • [x] .woodpecker.yaml line 5 — verified: clone step uses http://forgejo-http.forgejo.svc.cluster.local:80 as remote, confirming this is the URL that fails.

Repo Placement

Correct. The Forgejo Helm values live in pal-e-platform/terraform/main.tf and the issue is filed on forgejo_admin/pal-e-platform. Single-repo fix.

Dependencies

  • Board item #176 (todo-post-move-network-recovery, in_progress) — the post-move network recovery may have surfaced this IPv6 issue. Not a hard blocker, but the agent should be aware that network conditions may have changed.
  • Board item #188 (Issue #109: Platform cleanup, in_progress) — parent ops issue. This fix unblocks CI for all PRs under #109.
  • Issue #107 (closed) — the original TLS clone bug. PR #118 switched to internal URLs, which exposed this IPv6-only binding. The agent must NOT revert to external funnel URLs.
  • No hard blockers. This can proceed independently.

Acceptance Criteria

All three criteria are verifiable by an agent:
  • "Pipeline clone step succeeds" — push a commit, check Woodpecker pipeline status via MCP
  • "PR #117 CI checks pass" — check PR status after fix merges
  • "apply-on-merge pipeline fires" — merge a PR, verify pipeline triggers
Suggestion: add an explicit verification command, e.g., kubectl exec into Forgejo pod and confirm ss -tlnp | grep 80 shows 0.0.0.0:80 or *:80 (not just [::]:80).

Blast Radius

  • All CI pipelines across all repos — every Woodpecker pipeline uses the same internal Forgejo URL for cloning. This fix unblocks everything, not just pal-e-platform.
  • Blackbox exporter probe — terraform/main.tf line 410 shows the blackbox probe targets http://forgejo-http.forgejo.svc.cluster.local:80. If the probe pod connects via IPv4, this same IPv6-only issue could cause intermittent probe failures. The fix resolves this too.
  • Woodpecker server → Forgejo API — WOODPECKER_FORGEJO_URL at line 720 uses the same internal URL. OAuth callbacks and webhook processing may also be affected.
  • No negative blast radius — binding to 0.0.0.0 is strictly additive (adds IPv4, does not remove IPv6). No downstream breakage expected.

Recommendation

READY for agent execution. The root cause is now correctly identified, the fix is a single-line addition (HTTP_ADDR = "0.0.0.0" in the Forgejo server config), and the file target is verified. Minor template gaps (Test Expectations, Constraints, Checklist) are non-blocking — the scope is clear enough for an agent to execute.
Points assessment: 5 points is appropriate. The fix is small (one line) but requires a Helm redeploy of Forgejo, which is a high-risk operation on a stateful service. The agent must verify the pod restarts cleanly and all consumers reconnect.